@ngockhoale/ukit 3.4.69 → 3.4.70

package/template_project/.claude/ukit/runtime/operation-evidence.mjs

@@ -1,6 +1,14 @@
 // Adapter-normalized proof only; neither native output nor agent prose is evidence here.
 const MAX_OPERATIONS = 16;
 const validRemoteSync = (r) => Boolean(r) && typeof r === 'object' && ['remote', 'ref', 'sha'].every((k) => typeof r[k] === 'string' && r[k].length > 0 && r[k].length <= 256);
+export function githubRepository(value) {
+  const match = String(value || '').match(/^(?:https:\/\/github\.com\/|git@github\.com:)([A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+?)(?:\.git)?\/?$/);
+  return match ? match[1].toLowerCase() : null;
+}
+const validGithubView = (g) => Boolean(g) && typeof g === 'object'
+  && (g.repo === undefined || (typeof g.repo === 'string' && g.repo.length > 0 && g.repo.length <= 256))
+  && typeof g.url === 'string' && g.url.length > 0 && g.url.length <= 256
+  && ['PUBLIC', 'PRIVATE', 'INTERNAL'].includes(g.visibility);
 export function compactOperation(operation) {
   if (!operation || typeof operation !== 'object' || Array.isArray(operation)) return { invalid: true };
   const bounded = (value) => typeof value === 'string' && value.length > 0 && value.length <= 256;
@@ -13,7 +21,8 @@ export function compactOperation(operation) {
   return { domain: operation.domain, scope: operation.scope, role: operation.role, target: operation.target,
     ...(operation.state !== undefined ? { state: operation.state } : {}),
     ...(operation.presentTargets !== undefined ? { presentTargets: operation.presentTargets === null ? null : [...operation.presentTargets] } : {}),
-    complete: operation.complete === true, ...(validRemoteSync(operation.remoteSync) ? { remoteSync: { ...operation.remoteSync } } : {}) };
+    complete: operation.complete === true, ...(validRemoteSync(operation.remoteSync) ? { remoteSync: { ...operation.remoteSync } } : {}),
+    ...(validGithubView(operation.github) ? { github: { ...operation.github } } : {}) };
 }
 export function foldOperationEvidence(bank = {}, receipt, ledger) {
   const raw = receipt?.operation;
@@ -53,7 +62,13 @@ export function foldOperationEvidence(bank = {}, receipt, ledger) {
     : (op.role === 'state' && op.domain === 'git-integrity' && receipt.success === true && op.complete === true
       && validRemoteSync(priorSync) && Number.isSafeInteger(priorSync.observedSequence) && priorSync.observedSequence > lastMutation)
       ? { ...priorSync } : null;
-  const proof = { success: receipt.success === true, sequence: receipt.sequence,
+  // Carry visibility through subsequent state checks only until the next mutation.
+  const priorGithub = prior.state?.operation?.github;
+  const github = validGithubView(op.github) ? { ...op.github, observedSequence: receipt.sequence }
+    : (op.role === 'state' && op.domain === 'git-integrity' && receipt.success === true && op.complete === true
+      && validGithubView(priorGithub) && Number.isSafeInteger(priorGithub.observedSequence)
+      && priorGithub.observedSequence > lastMutation) ? { ...priorGithub } : null;
+  const proof = { success: receipt.success === true, exitStatusUnproven: receipt.exitStatusUnproven === true, sequence: receipt.sequence,
     toolUseId: receipt.toolUseId, taskInstanceId: receipt.taskInstanceId,
     sessionKey: receipt.sessionKey, operation: {
       domain: op.domain, scope: op.scope, role: op.role, target: op.target,
@@ -61,6 +76,7 @@ export function foldOperationEvidence(bank = {}, receipt, ledger) {
       ...(op.presentTargets !== undefined ? { presentTargets: [...op.presentTargets] } : {}),
       complete: op.complete === true,
       ...(remoteSync ? { remoteSync } : {}),
+      ...(github ? { github } : {}),
     } };
   return { ...bank, seenToolUseIds: receipt.toolUseId ? [...seen, receipt.toolUseId] : seen,
     [key]: { ...prior, [op.role]: proof } };
@@ -99,17 +115,25 @@ export function operationEvidenceStatus(goal, ledger = {}) {
     && (goal.target === null ? op.presentTargets.length === 0 : !op.presentTargets.includes(goal.target));
   const stateMatches = op?.state === goal.desiredState
     && (absent || (!Object.hasOwn(op || {}, 'presentTargets') && op?.target === goal.target));
-  if (!observation?.success || !observation.toolUseId || !Number.isSafeInteger(observation.sequence)
+  if (!observation?.success || observation.exitStatusUnproven || !observation.toolUseId || !Number.isSafeInteger(observation.sequence)
     || op.complete !== true || !stateMatches) return incomplete;
-  // Independent postcondition (masked/failed commit+push recovery): the REMOTE itself (git ls-remote, observed
-  // after every mutation attempt) must report live HEAD on this branch's own tracking remote, with a clean tree.
-  // `ledger.gitAuthority` is the gate-time local truth; without it (or on any mismatch) nothing is proven.
+  // Execute-and-verify requires a successful, exit-proven native mutation for EVERY target.
+  // Remote parity proves the resulting state, never that a masked/failed/missing operation executed.
+  const executed = proofs.every((proof) => proof?.success === true && !proof.exitStatusUnproven
+    && proof.toolUseId && Number.isSafeInteger(proof.sequence) && proof.sequence > 0
+    && observation.sequence > proof.sequence);
   const auth = ledger.gitAuthority;
-  if (goal.domain === 'git-integrity' && validRemoteSync(op.remoteSync) && auth && auth.clean === true
-    && requiredTargets.every((t) => t === 'commit' || t === 'push' || (t === 'tag' && Array.isArray(auth.tagsAtHead) && auth.tagsAtHead.length > 0))
+  // Remote parity does not prove repository visibility. Bind native GitHub state to the live remote.
+  if (goal.visibility === 'PRIVATE' && !(validGithubView(op?.github)
+    && op.github.visibility === 'PRIVATE' && githubRepository(auth?.remoteUrl) !== null
+    && githubRepository(op.github.url) === githubRepository(auth.remoteUrl))) return incomplete;
+  if (goal.domain === 'git-integrity' && executed && validRemoteSync(op.remoteSync) && auth && auth.clean === true
+    && requiredTargets.every((t) => t === 'commit' || t === 'push' || t === 'clean' || (t === 'tag' && Array.isArray(auth.tagsAtHead) && auth.tagsAtHead.length > 0))
     && attempts.every((r) => (Number.isSafeInteger(op.remoteSync.observedSequence) ? op.remoteSync.observedSequence : observation.sequence) > r.sequence)
     && op.remoteSync.sha === auth.head && op.remoteSync.ref === `refs/heads/${auth.branch}`
     && op.remoteSync.remote === auth.remote) return { complete: true, operationProof: 'remote-parity' };
+  // Push promises remote publication. No local check or missing gate-time authority can discharge it.
+  if (goal.domain === 'git-integrity' && requiredTargets.includes('push')) return incomplete;
   // A remote observation that disagrees with live local truth is divergence, not a verified state: it can never
   // be discharged by the fallback below just because a push command exited 0.
   if (goal.domain === 'git-integrity' && validRemoteSync(op.remoteSync) && auth
@@ -121,12 +145,12 @@ export function operationEvidenceStatus(goal, ledger = {}) {
     && attempts.every((proof) => Number.isSafeInteger(proof.sequence) && observation.sequence > proof.sequence)) {
     return { complete: true, operationProof: 'desired-state-only' };
   }
-  if (!proofs.every((proof) => proof?.success && proof.toolUseId && observation.toolUseId
-    && observation.sequence > proof.sequence)) return incomplete;
+  if (!executed) return incomplete;
   return { complete: true, operationProof: 'executed-and-verified' };
 }
 
 export function operationCompletionPolicy(contract, _adapterGoal, ledger) {
+  if (contract?.publication && !contract.operationGoal) return null; // Publication uses the registry-bound release-publication proof.
   const kind = String(contract?.taskKind || '').toUpperCase();
   if (!['OPERATIONAL', 'MIXED', 'CONFIGURATION'].includes(kind)
     || (kind === 'CONFIGURATION' && contract.configurationScope !== 'external')) return null;

package/template_project/.claude/ukit/runtime/stop-coordinator.mjs

@@ -26,6 +26,12 @@ import { withAsyncLock } from './async-lock.mjs';
 // the SAME selector filters the completion and blocked predicates below. Sandbox
 // runtimes that copy this file by an explicit sibling list must copy this module too.
 import { selectTaskScope } from './handoff-task-scope.mjs';
+// PreToolUse block-breaker cause matching for stop reconciliation — advisory and
+// fail-open: a missing/corrupt breaker module degrades to "no match" (a block then
+// stays a block; nothing is released), never to a changed stop verdict.
+let denialMatchesStopReason = () => false;
+let denialCauseMatchesStopReason = () => false;
+try { ({ denialMatchesStopReason, denialCauseMatchesStopReason } = await import('./block-breaker.mjs')); } catch { /* advisory */ }
 // TASK-005 (FR-005): the outcome seam loads LAZILY — a partial install missing
 // observability-emit.mjs must degrade to "no outcome record" (telemetry is
 // advisory), never crash the coordinator at module load.
@@ -199,7 +205,9 @@ export function normalizeEvaluatorStdout(stdout) {
     };
   }
   if (parsed && typeof parsed.systemMessage === 'string' && parsed.systemMessage) {
-    return { kind: 'advisory', systemMessage: parsed.systemMessage };
+    return { kind: 'advisory', systemMessage: parsed.systemMessage,
+      ...(parsed.outcome === 'blocked' && parsed.complete === false ? { outcome: 'blocked', complete: false } : {}),
+    };
   }
   return { kind: 'complete' };
 }
@@ -323,6 +331,79 @@ export function coordinateStopDecisions({ completion = null, watchdog = null, ha
     systemMessage: notes.length > 0 ? notes.join('\n') : undefined,
     policyOwner: 'none',
     policies,
+    ...(completion?.outcome === 'blocked' && completion?.complete === false ? { blockedOutcome: true } : {}),
+  };
+}
+
+// ─── PreToolUse block-breaker reconciliation (task-scoped) ─────────────────
+// Block owners whose Stop block an exhausted pretool denial may supersede. The fail-closed
+// blocker and any unknown/infrastructure owner are NEVER released — their blocks carry
+// conditions the breaker cannot verify (hook deadline overrun, evaluator failure).
+const PRETOOL_RELEASABLE_OWNERS = new Set(['completion-gate', 'handoff-cursor', 'task-watchdog']);
+
+/**
+ * Reconcile a coordinated Stop decision against the session's active exhausted PreToolUse
+ * denial (block-breaker.mjs `readActiveExhaustedBreaker`). Pure: returns a new merged
+ * object; a missing denial returns the input unchanged.
+ *
+ * Contract (user-mandated): a repeated preexecution denial with no allowed recovery ends
+ * the run TRUTHFULLY — BLOCKED_AND_STOP (`pretoolBlocked: true`), never COMPLETE, and
+ * never a Stop block that re-asks the exact denied action (a fake write/retry loop).
+ *   - decision block + the block's PRIMARY reason is EXACTLY the denial's full normalized
+ *     cause (strict `denialCauseMatchesStopReason` — no token/path overlap), the owner is a
+ *     releasable block owner (never fail-closed/infrastructure), and the merge holds NO
+ *     other independent obligation (a losing lane's provenance segment vetoes the release
+ *     and is never discarded) → the block is released as unenforceable (NOT approval;
+ *     nothing was retried or written; the denying guard's decision stands) and the stop
+ *     becomes a truthful blocked stop.
+ *   - no block + active denial → truthful blocked stop with an escalation note.
+ *   - anything else → untouched: independent ready work still continues.
+ * Conservative: "no allowed recovery" is never claimed from the denial threshold alone —
+ * it is asserted only on the release path, where the structural checks above have held.
+ * No automatic remediation exists for owner-decision denials (permission, credential,
+ * external service) — the breaker stays armed and the note says so; nothing here resets,
+ * disables, or releases the guard or any ledger state.
+ * @param {object} merged coordinateStopDecisions output (already loop-break applied or not)
+ * @param {{tool:string, reason:string, count:number, exhaustedAt?:number}|null} denial
+ * @returns {object} the reconciled merged decision
+ */
+export function reconcilePretoolDenial(merged, denial) {
+  if (!denial) return merged;
+  const rawReason = String(merged?.reason || '');
+  // Only the winning policy's own reason may count as the denied obligation, and a losing
+  // lane's provenance segment is an independent obligation inside THIS merge — it can
+  // never be discarded, so its presence vetoes any release outright.
+  const primaryReason = rawReason
+    .split(`\n${HANDOFF_PROVENANCE_PREFIX}`)[0]
+    .split(`\n${WATCHDOG_PROVENANCE_PREFIX}`)[0];
+  const independentObligation = rawReason.includes(`\n${HANDOFF_PROVENANCE_PREFIX}`)
+    || rawReason.includes(`\n${WATCHDOG_PROVENANCE_PREFIX}`);
+  const sameObligation = denialCauseMatchesStopReason(denial, primaryReason);
+  const denialFirstLine = String(denial.reason || '').split('\n', 1)[0].slice(0, 200);
+  if (merged?.decision === 'block') {
+    if (!sameObligation || independentObligation || !PRETOOL_RELEASABLE_OWNERS.has(merged.policyOwner)) return merged;
+    const note = [
+      `[ukit-block-breaker] BLOCKED/ESCALATED: this stop was blocked to demand "${primaryReason.split('\n', 1)[0].slice(0, 200)}", but that exact action was already denied ${denial.count} time(s) by ${denial.tool} for this task, and the coordinated merge holds no other independent obligation.`,
+      'The block is released as unenforceable — NOT approval: nothing was retried or written, and the denying guard\'s decision stands. No automatic remediation exists for this denial class (it needs an owner/permission decision).',
+      'Report the denial verbatim and stop; the breaker stays armed for this task until the route or the denial conditions change.',
+    ].join('\n');
+    return {
+      ...merged,
+      decision: null,
+      reason: undefined,
+      pretoolBlocked: true,
+      policyOwner: 'pretool-block-breaker',
+      systemMessage: [merged.systemMessage, note].filter(Boolean).join('\n'),
+    };
+  }
+  const note = [
+    `[ukit-block-breaker] BLOCKED/ESCALATED: the current task's action was denied ${denial.count} time(s) by ${denial.tool} ("${denialFirstLine}"), so this stop is BLOCKED — not COMPLETE.`,
+    'Report the denial verbatim; do not retry or re-delegate it. No automatic remediation exists for this denial class; it needs an owner decision.',
+  ].join('\n');
+  return {
+    ...merged,
+    pretoolBlocked: true,
+    systemMessage: [merged?.systemMessage, note].filter(Boolean).join('\n'),
   };
 }
 
@@ -2167,13 +2248,26 @@ function unfinishedMarkerNote(pause) {
     : 'WARNING: the run is unfinished, not completed, but RUN.md could not be marked `Paused: yes` (write failed) — the open obligation is not durably marked.';
 }
 
+// PID reuse guard: a process cannot own a claim written before it existed. `ps` start time has 1s resolution, so allow
+// 2s of skew. Unknown start time (no ps, Windows, timeout) keeps the previous conservative "alive means owner" behavior.
+function pidStartedAfter(pid, claimTs) {
+  if (pid === process.pid || !Number.isFinite(claimTs)) return false;
+  try {
+    const result = spawnSync('ps', ['-o', 'lstart=', '-p', String(pid)], { timeout: 1000, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'], env: { ...process.env, LC_ALL: 'C', TZ: process.env.TZ } });
+    const started = Date.parse(String(result.stdout || '').trim());
+    return result.status === 0 && Number.isFinite(started) && started > claimTs + 2000;
+  } catch { return false; }
+}
+
 // ─── Once-per-stop guard ──────────────────────────────────────────────────
 /**
  * Lock-scoped dedupe: persist `{ lastStop: { key, ts } }` and report whether this
- * invocation is a same-session duplicate inside the window. Fail-open — an
- * unreadable/unlockable dedupe state must never disable the Stop coordinator.
+ * invocation is a same-session duplicate inside the window. Decision-aware callers
+ * also suppress evaluation on lock contention or live capacity exhaustion; they emit
+ * a coordination BLOCK instead of racing evaluator mutations. Unavailable storage
+ * retains the evaluator's bounded failure lifecycle. Legacy callers fail open.
  */
-export async function alreadyCoordinatedThisStop({ projectRoot, sessionKey, now, dedupeWindowMs, lockBudgetMs }) {
+export async function alreadyCoordinatedThisStop({ projectRoot, sessionKey, now, dedupeWindowMs, lockBudgetMs, replayOnlyBlocked = false, claimToken = crypto.randomUUID() }) {
   const statePath = path.join(projectRoot, '.ukit', 'storage', 'cache', 'stop-coordinator', 'state.json');
   try {
     const outcome = await withAsyncLock(statePath, { deadlineMs: lockBudgetMs }, async () => {
@@ -2181,12 +2275,35 @@ export async function alreadyCoordinatedThisStop({ projectRoot, sessionKey, now,
       try {
         current = JSON.parse(await fs.readFile(statePath, 'utf8')) || current;
       } catch {}
-      const last = current.lastStop;
+      const liveClaim = (entry) => {
+        // Legacy window-only callers do not finalize claims; only the decision-aware
+        // coordinator owns an in-flight evaluation that can outlive the replay TTL.
+        if (!replayOnlyBlocked || !entry || entry.decision || !Number.isInteger(entry.pid)) return false;
+        if (now - Number(entry.ts) < 0 || now - Number(entry.ts) >= 30_000) return false;
+        try { process.kill(entry.pid, 0); } catch (error) { return error.code === 'EPERM' ? !pidStartedAfter(entry.pid, Number(entry.ts)) : false; }
+        return !pidStartedAfter(entry.pid, Number(entry.ts));
+      };
+      const claim = current.stopClaims?.[sessionKey];
+      const last = claim || current.lastStop;
+      const decision = claim ? claim.decision : current.lastStopDecision;
       const lastTs = Number(last?.ts);
-      if (last && last.key === sessionKey && Number.isFinite(lastTs) && now - lastTs >= 0 && now - lastTs < dedupeWindowMs) {
+      // Successful/terminal releases are never reusable authority: workspace,
+      // HEAD, remote state and time-dependent predicates may have changed.
+      if (liveClaim(claim) || (last && last.key === sessionKey && Number.isFinite(lastTs) && now - lastTs >= 0 && now - lastTs < dedupeWindowMs
+        && (!replayOnlyBlocked || !decision || decision.decision === 'block'))) {
         return true;
       }
+      const retained = Object.entries(current.stopClaims || {})
+        .filter(([, entry]) => liveClaim(entry) || (now - Number(entry.ts) >= 0 && now - Number(entry.ts) < dedupeWindowMs))
+        .map(([key, entry]) => ({ key, entry, live: liveClaim(entry) }))
+        .sort((a, b) => Number(b.live) - Number(a.live) || Number(b.entry.ts) - Number(a.entry.ts));
+      // Never trade a live evaluator's ownership for a new slot. Capacity pressure
+      // suppresses the newcomer (explicit BLOCK at the adapter), not the owner.
+      if (retained.filter(claim => claim.live).length >= 64) return true;
       await fs.mkdir(path.dirname(statePath), { recursive: true });
+      delete current.lastStopDecision;
+      current.stopClaims = Object.fromEntries(retained.slice(0, 63).map(({ key, entry }) => [key, entry]));
+      current.stopClaims[sessionKey] = { key: sessionKey, ts: now, token: claimToken, pid: process.pid };
       // BUG-C23-08: spread `current` — a bare { lastStop } write erased the
       // `handoff` stall-streak slot written by bumpHandoffStallCount, which ran
       // AFTER this dedupe write each invocation → count always read 1 and the
@@ -2194,12 +2311,33 @@ export async function alreadyCoordinatedThisStop({ projectRoot, sessionKey, now,
       await fs.writeFile(statePath, `${JSON.stringify({ ...current, lastStop: { key: sessionKey, ts: now } }, null, 1)}\n`, 'utf8');
       return false;
     });
-    return outcome.ok ? outcome.value === true : false;
+    return outcome.ok ? outcome.value === true : replayOnlyBlocked && outcome.reason === 'busy';
   } catch {
+    // Unavailable storage is not evidence of another evaluator. Preserve the
+    // evaluator's existing bounded infrastructure-failure/loud-release lifecycle.
     return false;
   }
 }
 
+// Finalize only the claim owned by this evaluator; a concurrent callback must
+// never replace another task's pending claim or decision.
+export async function publishStopDecision({ projectRoot, key, evaluatedKey = key, claimToken, decision, now, lockBudgetMs }) {
+  const statePath = path.join(projectRoot, '.ukit/storage/cache/stop-coordinator/state.json');
+  try {
+    await withAsyncLock(statePath, { deadlineMs: lockBudgetMs }, async () => {
+      const state = JSON.parse(await fs.readFile(statePath, 'utf8'));
+      if (state.stopClaims?.[key]?.token !== claimToken) return;
+      delete state.stopClaims[key];
+      state.stopClaims[evaluatedKey] = { key: evaluatedKey, ts: now, decision };
+      if (state.lastStop?.key === key && Number(state.lastStop.ts) === now) {
+        state.lastStop.key = evaluatedKey;
+        state.lastStopDecision = decision;
+      }
+      await fs.writeFile(statePath, `${JSON.stringify(state)}\n`, 'utf8');
+    });
+  } catch { /* a missing decision can never authorize a duplicate release */ }
+}
+
 // ─── Worktree scoping ─────────────────────────────────────────────────────
 // The resolver lives in the shared handoff-intent module (also used by the
 // SessionStart resume hook). Unavailable module → the primary `projectRoot`, i.e.
@@ -2222,6 +2360,142 @@ async function readRunCycle(runRoot) {
   }
 }
 
+// Bounded async Git probe: stdout capped by maxBuffer, killed at timeout, never throws. `error` is set for
+// spawn failure, timeout and overflow so callers treat the currency as unknown rather than reusing a decision.
+function boundedGit(args, { cwd, timeout, maxBuffer }) {
+  return new Promise((resolve) => {
+    let settled = false;
+    const chunks = [];
+    let size = 0;
+    let child;
+    const done = (result) => { if (!settled) { settled = true; clearTimeout(timer); resolve(result); } };
+    const timer = setTimeout(() => { try { child?.kill('SIGKILL'); } catch {} done({ error: new Error('git probe timed out'), status: null, stdout: Buffer.alloc(0) }); }, timeout);
+    try { child = spawn('git', args, { cwd, stdio: ['ignore', 'pipe', 'ignore'] }); } catch (error) { done({ error, status: null, stdout: Buffer.alloc(0) }); return; }
+    child.on('error', (error) => done({ error, status: null, stdout: Buffer.alloc(0) }));
+    child.stdout.on('data', (chunk) => {
+      size += chunk.length;
+      if (size > maxBuffer) { try { child.kill('SIGKILL'); } catch {} done({ error: new Error('git probe exceeded maxBuffer'), status: null, stdout: Buffer.alloc(0) }); return; }
+      chunks.push(chunk);
+    });
+    child.on('close', (status) => done({ status, stdout: Buffer.concat(chunks) }));
+  });
+}
+
+// Shared candidate/input currency for native Stop adapters. A key is not a
+// completion certificate; adapters may reuse BLOCK only, never successful release.
+export async function stopCoordinationInput({ projectRoot, payload = {}, authority = null }) {
+  const explicitSession = [payload.session_id, payload.sessionId].find(value => typeof value === 'string' && value.trim());
+  const sessionKey = explicitSession || (typeof payload?.transcript_path === 'string' && payload.transcript_path ? payload.transcript_path : 'no-session');
+  // Dedupe is only a short-lived suppression of repeated BLOCK mutations, not
+  // a completion certificate. Fixed-path metadata avoids walking histories,
+  // reading entire transcripts, or following directory symlink cycles.
+  const safeSession = String(explicitSession || 'default').trim().replace(/[^a-zA-Z0-9._-]/g, '_').slice(0, 96) || 'default';
+  const ledgerSession = explicitSession ? safeSession : payload.transcript_path
+    ? `transcript-${crypto.createHash('sha256').update(String(payload.transcript_path)).digest('hex').slice(0, 20)}` : 'default';
+  const inputs = [
+    '.claude/ukit/skill-router-state.json',
+    `.ukit/storage/cache/route-state/${safeSession}.json`,
+    `.ukit/storage/cache/exec-ledger/${ledgerSession}.json`,
+    '.ukit/storage/config.json',
+    'docs/AI_HANDOFF/RUN.md',
+    'docs/AI_HANDOFF/INDEX.md',
+    'docs/AI_HANDOFF/tasks',
+  ].map((input) => path.join(projectRoot, input));
+  if (payload.transcript_path) inputs.push(payload.transcript_path);
+  async function stopInputKey() {
+    const hash = crypto.createHash('sha256');
+    const currency = crypto.createHash('sha256');
+    const { stop_hook_active, ...authorityPayload } = payload;
+    hash.update(JSON.stringify(authorityPayload));
+    if (authority !== null) hash.update(JSON.stringify(authority));
+    // Bound both Git probes; unknown/oversize currency disables reuse rather
+    // than accepting an old decision. Successful decisions are never replayed.
+    // The three probes are independent: run them concurrently so Stop pays one Git latency, not three.
+    const [head, diff, untracked] = await Promise.all([
+      boundedGit(['rev-parse', 'HEAD'], { cwd: projectRoot, timeout: 1500, maxBuffer: 1024 * 1024 }),
+      boundedGit(['diff', 'HEAD', '--no-ext-diff', '--', '.', ':(exclude).ukit/storage/**',
+        ':(exclude).claude/ukit/skill-router-state.json', ':(exclude)docs/STATUS.md', ':(exclude)docs/WORKLOG.md'],
+      { cwd: projectRoot, timeout: 1500, maxBuffer: 1024 * 1024 }),
+      boundedGit(['ls-files', '--others', '--exclude-standard', '-z', '--', '.',
+        ':(exclude).ukit/storage/**', ':(exclude)docs/STATUS.md', ':(exclude)docs/WORKLOG.md'],
+      { cwd: projectRoot, timeout: 1500, maxBuffer: 256 * 1024 }),
+    ]);
+    for (const result of [head, diff]) {
+      const value = result.error ? crypto.randomUUID() : result.status === 0 ? result.stdout : 'no-git-currency';
+      hash.update(value);
+      currency.update(value);
+    }
+    const extraInputs = untracked.status === 0 ? untracked.stdout.toString('utf8').split('\0').filter(Boolean) : [];
+    if (untracked.error || extraInputs.length > 512) {
+      const unknown = crypto.randomUUID();
+      hash.update(unknown); currency.update(unknown);
+    }
+    // Directory metadata does not change when an existing task is rewritten.
+    // Inspect a bounded direct-child inventory; nested/oversize/unknown scopes
+    // disable reuse rather than recursively walking or truncating authority.
+    const taskInputs = [];
+    let taskDirectory;
+    try {
+      taskDirectory = await fs.opendir(path.join(projectRoot, 'docs/AI_HANDOFF/tasks'));
+      for await (const entry of taskDirectory) {
+        if (taskInputs.length >= 512 || !entry.isFile()) {
+          const unknown = crypto.randomUUID();
+          hash.update(unknown); currency.update(unknown);
+          break;
+        }
+        taskInputs.push(path.join(projectRoot, 'docs/AI_HANDOFF/tasks', entry.name));
+      }
+    } catch (error) {
+      if (error.code !== 'ENOENT') {
+        const unknown = crypto.randomUUID();
+        hash.update(unknown); currency.update(unknown);
+      }
+    } finally {
+      try { await taskDirectory?.close(); } catch {}
+    }
+    // Metadata detects rewrites without reading file bodies. Sort the inventory
+    // so filesystem enumeration order cannot manufacture a new coordination key.
+    for (const filename of [...inputs, ...taskInputs.sort(), ...extraInputs.slice(0, 512).map(file => path.join(projectRoot, file))]) {
+      hash.update(filename);
+      let metadata = 'missing';
+      try {
+        const stat = await fs.lstat(filename, { bigint: true });
+        metadata = `${stat.dev}:${stat.ino}:${stat.size}:${stat.mtimeNs}:${stat.ctimeNs}`;
+      } catch {}
+      hash.update(metadata);
+      // The evaluator records continuation bookkeeping in its own ledger.
+      // Other authority changes must never be stamped onto the old verdict.
+      if (filename !== path.join(projectRoot, `.ukit/storage/cache/exec-ledger/${ledgerSession}.json`)) {
+        currency.update(filename).update(metadata);
+      } else {
+        // Metadata alone cannot distinguish this evaluator's counter write from
+        // an arriving receipt. Compare bounded semantic ledger content, excluding
+        // only Stop bookkeeping; receipts/evidence/task ownership remain authority.
+        let handle;
+        try {
+          handle = await fs.open(filename, 'r');
+          const size = Number((await handle.stat()).size);
+          if (size > 1024 * 1024) throw new Error('ledger currency exceeds budget');
+          const buffer = Buffer.alloc(size);
+          const { bytesRead } = await handle.read(buffer, 0, size, 0);
+          if (bytesRead !== size) throw new Error('ledger changed during currency read');
+          const ledger = JSON.parse(buffer.toString('utf8'));
+          for (const field of ['continuationCount', 'noProgressCount', 'lastProgressDigest',
+            'continuationRequestKey', 'lastContinuationAt', 'updatedAt', 'notified', 'stopProgressFingerprint']) delete ledger[field];
+          currency.update(JSON.stringify(ledger));
+        } catch (error) {
+          currency.update(error.code === 'ENOENT' ? 'missing-ledger' : crypto.randomUUID());
+        } finally {
+          try { await handle?.close(); } catch {}
+        }
+      }
+    }
+    return { key: `${sessionKey}:${hash.digest('hex')}`, currency: currency.digest('hex') };
+  }
+
+  return stopInputKey();
+}
+
 // ─── Orchestration ────────────────────────────────────────────────────────
 /**
  * One coordinator invocation: event guard → once-per-stop dedupe → completion
@@ -2242,15 +2516,10 @@ export async function runStopCoordinator({
     return { skip: `ignored event: ${event}`, merged: null };
   }
 
-  const sessionKey = typeof payload?.session_id === 'string' && payload.session_id
-    ? payload.session_id
-    : (typeof payload?.transcript_path === 'string' && payload.transcript_path ? payload.transcript_path : 'no-session');
-  if (await alreadyCoordinatedThisStop({ projectRoot, sessionKey, now, dedupeWindowMs, lockBudgetMs })) {
-    return { skip: 'duplicate Stop invocation for this session inside the dedupe window', merged: null };
-  }
+  const explicitSession = [payload.session_id, payload.sessionId].find(value => typeof value === 'string' && value.trim());
+  const sessionKey = explicitSession || (typeof payload?.transcript_path === 'string' && payload.transcript_path ? payload.transcript_path : 'no-session');
 
-  // User pause/cancel outranks every lane: release, change nothing (RUN.md, tasks,
-  // branches, worktrees stay as they are so the run can be resumed).
+  // Explicit user control must outrank even an in-flight duplicate claim.
   const interruption = await detectUserInterruption(
     typeof payload?.transcript_path === 'string' ? payload.transcript_path : null,
   );
@@ -2259,7 +2528,7 @@ export async function runStopCoordinator({
       skip: null,
       merged: {
         decision: null,
-        reason: undefined,
+        terminalOutcome: 'WAIT_FOR_APPROVAL',
         systemMessage:
           `[ukit-stop-coordinator] stop allowed: the user requested ${interruption.kind}. ` +
           `No verification or continuation is forced; run state is preserved. ` +
@@ -2270,30 +2539,6 @@ export async function runStopCoordinator({
     };
   }
 
-  let completion = null;
-  const failures = {};
-  try {
-    completion = await evaluateCompletionPolicy({ projectRoot, rawInput, budgetMs: ledgerBudgetMs });
-  } catch (error) {
-    failures.completion = error?.message || String(error);
-    // Raw detail is loud on stderr; the parsed decision stays redacted.
-    process.stderr.write(`[ukit-stop-coordinator] completion evaluator failed: ${failures.completion}\n`);
-  }
-
-  let watchdog = null;
-  try {
-    const watchdogRuntime = await import(new URL('./task-watchdog.mjs', import.meta.url).href);
-    watchdog = await watchdogRuntime.evaluateStopWatchdog({
-      projectRoot,
-      now,
-      lockBudgetMs,
-      cycle: await readRunCycle(await resolveRunRoot(projectRoot, payload?.cwd)),
-    });
-  } catch (error) {
-    failures.watchdog = error?.message || String(error);
-    process.stderr.write(`[ukit-stop-coordinator] task-watchdog evaluator failed: ${failures.watchdog}\n`);
-  }
-
   // Provider quota / rate limit: a genuine external pause. Release the stop with
   // an advisory, mark the cursor PAUSED via the shared `Paused: yes` contract
   // (`Phase:` untouched), and never report completion for this stop.
@@ -2328,6 +2573,46 @@ export async function runStopCoordinator({
     }
   } catch { /* advisory lane: detection failure never changes the stop */ }
 
+  const initialInput = await stopCoordinationInput({ projectRoot, payload });
+  const dedupeKey = initialInput.key;
+  const claimToken = crypto.randomUUID();
+  if (await alreadyCoordinatedThisStop({ projectRoot, sessionKey: dedupeKey, now, dedupeWindowMs, lockBudgetMs, replayOnlyBlocked: true, claimToken })) {
+    // Suppress duplicate evaluator mutations, not the safety decision. Empty
+    // output is permission to stop to the host, even if the first call blocked.
+    try {
+      const state = JSON.parse(await fs.readFile(path.join(projectRoot, '.ukit/storage/cache/stop-coordinator/state.json'), 'utf8'));
+      const decision = state.stopClaims?.[dedupeKey]?.decision;
+      if (decision?.decision === 'block') return { skip: null, merged: decision };
+    } catch { /* an in-flight/failed first call cannot authorize completion */ }
+    return { skip: null, merged: { decision: 'block',
+      reason: 'UKit completion gate: Stop evaluation ownership is pending or unavailable (duplicate, claim capacity, or lock contention). No evaluator was admitted and no completion has been verified; a subsequent Stop can recheck ownership.',
+      policyOwner: 'stop-coordinator', policies: ['stop-dedupe'] } };
+  }
+
+  let completion = null;
+  const failures = {};
+  try {
+    completion = await evaluateCompletionPolicy({ projectRoot, rawInput, budgetMs: ledgerBudgetMs });
+  } catch (error) {
+    failures.completion = error?.message || String(error);
+    // Raw detail is loud on stderr; the parsed decision stays redacted.
+    process.stderr.write(`[ukit-stop-coordinator] completion evaluator failed: ${failures.completion}\n`);
+  }
+
+  let watchdog = null;
+  try {
+    const watchdogRuntime = await import(new URL('./task-watchdog.mjs', import.meta.url).href);
+    watchdog = await watchdogRuntime.evaluateStopWatchdog({
+      projectRoot,
+      now,
+      lockBudgetMs,
+      cycle: await readRunCycle(await resolveRunRoot(projectRoot, payload?.cwd)),
+    });
+  } catch (error) {
+    failures.watchdog = error?.message || String(error);
+    process.stderr.write(`[ukit-stop-coordinator] task-watchdog evaluator failed: ${failures.watchdog}\n`);
+  }
+
   let handoff = null;
   try {
     handoff = await evaluateHandoffCursor({
@@ -2344,8 +2629,27 @@ export async function runStopCoordinator({
     process.stderr.write(`[ukit-stop-coordinator] handoff-cursor evaluator failed: ${failures.handoff}\n`);
   }
 
+  // PreToolUse block-breaker read (advisory, fail-open): the session's active exhausted
+  // denial, scoped to the CURRENT per-session route task. A missing/corrupt breaker or a
+  // stale entry (owner task changed / window expired) reads as null and never changes
+  // the verdict — no global fallback, no blanket release, no guard reset.
+  let pretoolDenial = null;
+  try {
+    const breaker = await import('./block-breaker.mjs');
+    pretoolDenial = breaker.readActiveExhaustedBreaker({ projectRoot, payload, now });
+  } catch { /* advisory lane: an unreadable breaker never changes the stop verdict */ }
+
   let merged = coordinateStopDecisions({ completion, watchdog, handoff, failures });
 
+  // Reconcile BEFORE the loop-breaker so a conflicting block is already released when
+  // the loop detector looks at the decision (the loop-state lane independently ignores
+  // pretool denials and must not re-block a released one). Unique insertion point.
+  if (pretoolDenial) {
+    try {
+      merged = reconcilePretoolDenial(merged, pretoolDenial);
+    } catch { /* advisory: reconciliation failure keeps the original decision */ }
+  }
+
   // Bounded loop detection (fail-closed infra block keeps its own cap).
   try {
     const loop = await import('./loop-state.mjs');
@@ -2357,7 +2661,7 @@ export async function runStopCoordinator({
   // (user interruption or quota pause) waits — it is never COMPLETE.
   // Advisory label only (nothing consumes it); a gate block approves nothing.
   merged.terminalOutcome = merged.decision === 'block' ? 'CONTINUE_REQUIRED'
-    : merged.loopBreak === true ? 'BLOCKED_AND_STOP'
+    : merged.loopBreak === true || merged.blockedOutcome === true || merged.pretoolBlocked === true ? 'BLOCKED_AND_STOP'
     : merged.quotaPause === true || handoff?.waitForApproval === true ? 'WAIT_FOR_APPROVAL' : 'COMPLETE_AND_STOP';
 
   // C85 TASK-015 (BL-015): advisory review-policy verdict. The evaluator runs
@@ -2414,6 +2718,7 @@ export async function runStopCoordinator({
   // null and never changes the decision the caller is about to emit.
   {
     const stopOutcomeVerdict = merged.decision === 'block' ? 'BLOCKED'
+      : merged.pretoolBlocked === true || merged.blockedOutcome === true ? 'BLOCKED'
       : typeof merged.systemMessage === 'string' && merged.systemMessage ? 'INCONCLUSIVE'
       : 'VERIFIED';
     // runId joins ledger-emitted outcomes on the same session identity the
@@ -2421,14 +2726,15 @@ export async function runStopCoordinator({
     // instead of leaking it; 'no-session' stays null (missing-data contract).
     const outcomePayload = sessionKey === 'no-session'
       ? payload
-      : (typeof payload?.session_id === 'string' && payload.session_id
+      : ((typeof payload?.session_id === 'string' && payload.session_id)
+        || (typeof payload?.sessionId === 'string' && payload.sessionId)
         ? { session_id: sessionKey }
         : { transcript_path: sessionKey });
     try {
       const emitModule = await loadOutcomeEmitModule();
       if (!emitModule || typeof emitModule.buildOutcomeObservedRecord !== 'function'
         || typeof emitModule.emitOutcomeObserved !== 'function') {
-        return { skip: null, merged };
+        throw new Error('Outcome telemetry unavailable');
       }
       const outcomeRecord = emitModule.buildOutcomeObservedRecord({
         outcome: {
@@ -2451,6 +2757,11 @@ export async function runStopCoordinator({
     } catch { /* telemetry never blocks or delays the stop decision */ }
   }
 
+  // Publish the decision only for the exact coordination claim we evaluated.
+  // Concurrent later Stops must never receive an earlier task's cached result.
+  const evaluatedInput = await stopCoordinationInput({ projectRoot, payload });
+  const evaluatedKey = initialInput.currency === evaluatedInput.currency ? evaluatedInput.key : dedupeKey;
+  await publishStopDecision({ projectRoot, key: dedupeKey, evaluatedKey, claimToken, decision: merged, now, lockBudgetMs });
   return { skip: null, merged };
 }
 
@@ -2499,7 +2810,9 @@ async function main() {
     return;
   }
   if (merged.systemMessage) {
-    writeDecisionLine({ systemMessage: merged.systemMessage, policyOwner: merged.policyOwner });
+    writeDecisionLine({ systemMessage: merged.systemMessage, policyOwner: merged.policyOwner,
+      ...(merged.blockedOutcome ? { outcome: 'blocked', complete: false, continue: false } : {}),
+    });
   }
   // Neither → silent release: both policies decided "complete".
 }